Secure Hibernation in a Locked Down World
summary
Lockdown LSM currently disables hibernation because a tampered hibernation image can load an attacker kernel; the patchset generates a TPM key in-kernel tied to boot state by extending PCR 5 in the EFI stub and a kernel-controlled NV index, uses an audit-session-signed attestation to prove key provenance, encrypts the image with that key, and verifies the audit on resume. Prototype exists, patches coming, works end-to-end but needs kernel NV/PCR support and stricter TPM access controls to close corner cases.
AI-written summary · about
chapters (10)
- 0:00Secure hibernation challenges
- 3:11Secure boot and lockdown mode
- 5:17Hibernation mechanics and risks
- 10:33TPM keys and PCR limits
- 15:37Kernel PCR modification bypass
- 19:53PCR 5 and NV indices for verification
- 23:26TPM audit sessions for keys
- 28:29Implementing secure hibernation
- 30:15Current status and challenges
- 33:03Q&A on UEFI and PCRs
related talks
43mHardware-backed Per-process Secrets
49mBreaking Hardware-Enforced Security With Hypervisors
26mA Bad Dream: Subverting Trusted Platform Module While You Are Sleeping
27mSecuring TPM Secrets with TXT and Kernel Signatures
15mRemote Attestation in AMD SEV-SNP Confidential VMs
41mUsing the TPM NVRAM to Protect Secure Boot Keys in POWER9 OpenPOWER Systems
42mRecent TPM Security Enhancements to the Linux Kernel
51mApplications of TPM 2.0